Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPGMail 2 is finally here

gpgtools.org

Post reply on HN
Print view View original

61–70 of 77 posts

Re: GPGMail 2 is finally here

#61

Post by joshuak »

mseebach wrote: post #52
Osmium wrote: post #33

Earlier quoted context omitted.

Any recommended CAs for S/MIME for personal users? And is it possibly to transparently use both, e.g. sign all outgoing mail with S/MIME by default, but also encrypt with, say, GPG if you happen to have that contact's public key?

No. You absolutely must confirm the key of people you correspond with. An internal CA in your organisation could achieve this, but the "trust a random list of CAs" model of security is fragile, and must be considered compromised in the face of an adversary like the NSA (or any government in a country where a CA on your trusted list is located).

Well either you trust the CA system or you don't. If you do then receiving a s/mime signature, that your OS thinks is valid because of the root certificates that it accepts, then you can trust it "transparently".

If you don't trust the CA system, well then the web is a very scary place for you because it's all built on that and email is probably the least of your concerns.

The CAs are generally not "a random list", but rather a publicly accepted and accredited CA. Just like your https cert.

Re: GPGMail 2 is finally here

#62

Post by northwest »

xorbyte wrote: post #39
undoware wrote: post #26

This is just MacOS nonsense. It plays in the Valley and at the mall, and nowhere else. The only reason it is on the front page of Hacker News is that we can't see outside our own event horizon. Poke me when a popular web email service implements GPG.

Hushmail implements GPG, though perhaps it does not pass your definition of 'popular'. Any current implementation of GPG by _web email_ is probably insecure as it would rely on JavaScript cryptography. Perhaps when the W3C passes the browser cryptography draft, and browsers start adding that in, we might see this. But the economics aren't aligned, because popular web email services want to see what you read and write…

I wouldn't really recommend Hushmail:

http://www.cybercrimereview.com/2012/11/hushmail-provides-un...

Re: GPGMail 2 is finally here

#63

Post by lbenes »

I had some experience with GnuPG and Symantec PGP and Outlook a few years back. All non-public information like CAD files were supposed to be PGP encrypted. Yet, even the engineers would send most files in plain text. I remember many times having to logmein to a clients machine to try to figure out why they couldn't read our emails. This is why PGP never took off.

Until the tools take 5 min to setup, and encryption/decryption is automatically handled by the mail client, PGP will never take off. Things like the public key directory have to handled transparently to the user.

It's too bad Mozilla dropped support for Thunderbird. Tight integration with GnuPG plugin could have made mainstream PGP a reality. For OS X at least, it looks like GPGMail is nearly there.

Re: GPGMail 2 is finally here

#64

Post by andrewflnr »

joshuak wrote: post #61
mseebach wrote: post #52

Earlier quoted context omitted.

No. You absolutely must confirm the key of people you correspond with. An internal CA in your organisation could achieve this, but the "trust a random list of CAs" model of security is fragile, and must be considered compromised in the face of an adversary like the NSA (or any government in a country where a CA on your trusted list is located).

Well either you trust the CA system or you don't. If you do then receiving a s/mime signature, that your OS thinks is valid because of the root certificates that it accepts, then you can trust it "transparently". If you don't trust the CA system, well then the web is a very scary place for you because it's all built on that and email is probably the least of your concerns. The CAs are generally not "a random list", b…

No. Degrees of trust are allowed, and you can choose to do different things in different contexts (browsing vs email) depending on the likelihood and likely damage of betrayal.

Re: GPGMail 2 is finally here

#65

Post by unimpressive »

lbenes wrote: post #63

I had some experience with GnuPG and Symantec PGP and Outlook a few years back. All non-public information like CAD files were supposed to be PGP encrypted. Yet, even the engineers would send most files in plain text. I remember many times having to logmein to a clients machine to try to figure out why they couldn't read our emails. This is why PGP never took off. Until the tools take 5 min to setup, and encryption/d…

>Until the tools take 5 min to setup, and encryption/decryption is automatically handled by the mail client, PGP will never take off. Things like the public key directory have to handled transparently to the user.

Actually, we're close to that. I have had trouble figuring out how to smoothly encrypt attachments though. (I'm sure it can be done though.)

Five minutes to set up? Yeah pretty much.

Encryption/decryption of emails is handled automatically in enigmail after the first encrypted email is sent. You can set it up so that for certain users it sends them an encrypted message by default. (Though the interface for this is a little confusing, it could use some polish.)

It helps you import a key if a fingerprint is included or a public key attached to the email.

I was actually pretty impressed with what I didn't have to do. It still needs some improvement though.

Re: GPGMail 2 is finally here

#66

Post by reeses »

Camillo wrote: post #37
lukele wrote: post #35

Earlier quoted context omitted.

There's a special hack version out for Mavericks: https://s3.amazonaws.com/gpgtools/GPGMail-Mavericks-P2-hack.... And you need this fix for the latest DP 4: http://support.gpgtools.org/discussions/everything/9888-mave...

They just shipped support for Mountain Lion, which was released one year ago. I hope there is not as big a delay for Mavericks. I understand that it's a volunteer project, but a kickstarter could surely help them muster the $100 for a Mac developer subscription and access to the developer previews of 10.9.

You're underestimating the level of effort here. It's not about lacking the $100 (they've received more than that in donations), it's that Apple makes significant changes to the way their applications are built and run and they don't communicate the changes very well, if at all.

In addition, as the apps are linked and compiled with different settings (clang, no ppc, no 32-bit, etc.) then plugins that are dependent on these APIs have to find their own way.

ML was a huge change from Lion in many ways. Mavericks has some issues that an individual can resolve on their own (mostly) but it's a moving target as it is not released yet.

But I do encourage you to donate. Integration with your native mail app should be worth $50-100+.

Re: GPGMail 2 is finally here

#67

Post by napoleond »

joshuak wrote: post #19

My company's internal mail goes through gmail so I decided after recent news to setup GPGmail and s/mime. I identified a couple of usability issues, which where fixed. I'd say all in all its very good. Regardless if you believe or care about the NSA issues, simply the idea of routing clear text email through mail exchanges, and advertisers should give you enough reason to follow the few steps it requires to generate…

GPGMail is not quite Grandmother ready

My little company is working on an encrypted email solution that is--http://parley.co will be entering pre-beta next week :)

Re: GPGMail 2 is finally here

#68

Post by indeyets »

joshuak wrote: post #61
mseebach wrote: post #52

Earlier quoted context omitted.

No. You absolutely must confirm the key of people you correspond with. An internal CA in your organisation could achieve this, but the "trust a random list of CAs" model of security is fragile, and must be considered compromised in the face of an adversary like the NSA (or any government in a country where a CA on your trusted list is located).

Well either you trust the CA system or you don't. If you do then receiving a s/mime signature, that your OS thinks is valid because of the root certificates that it accepts, then you can trust it "transparently". If you don't trust the CA system, well then the web is a very scary place for you because it's all built on that and email is probably the least of your concerns. The CAs are generally not "a random list", b…

That's exactly the reason, why "DANE" approach is developed now, to replace CAs use for HTTPS

https://tools.ietf.org/wg/dane/ http://www.internetsociety.org/articles/dane-taking-tls-auth...

Re: GPGMail 2 is finally here

#69

Post by indeyets »

gmac wrote: post #47

I currently use Mail.app's built-in signing and encrypting capability with a free StartCom S/MIME cert. Does this offer something more/different?

signature process is almost the same, but this thing uses different approach to "trust" to the signatures.

In case of S/MIME email client will tell you that signature is good if it the key, which was used for creating it was issued by a known CA (Certificate Authority).

In case of OpenPGP(GPG,GnuPG,…) you explicitly decide if signature is good either by verifying the key (once) directly with the sender or by using web-of-trust (you trust keys of your friends, who trust keys of their friends, who trusts your correspondent)

http://security.stackexchange.com/questions/7874/how-does-pg...

Re: GPGMail 2 is finally here

#70

Post by cel »

Steuard wrote: post #46
gcv wrote: post #21

The last version of GPGTools I looked at had the irritating habit of always installing its own copy of GPG into /usr/local and not letting me use my own version (e.g., from Homebrew). Is this still the case in version 2? It would be far cleaner if it was more self-contained (e.g., included GPG inside its installation bundle), and then let the user pick an alternative OpenPGP installation in the preferences.

There is a "Customize" option in the installer that seems to provide an option to not install MacGPG, but I haven't tried that to make sure.

Yes, you can choose to install GPGMail, GPGPreferences, etc., without MacGPG, and use your own gpg binaries such as from homebrew.
Post reply on HN